@junghanacs/entwurf 0.22.0 → 0.23.1

package/scripts/mutants/mux-fresh-call.json

@@ -5,7 +5,7 @@
 		{
 			"claim": "FRESHCALL-PI-ARGV-PROMPT-FIRST",
 			"title": "pi gets the flag before the prompt again — the measured shape that opens a window whose first turn never runs",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": ["\t\t\treturn [composition.prompt, \"--entwurf-control\", \"--model\", model];"],
 			"replace": ["\t\t\treturn [\"--entwurf-control\", composition.prompt, \"--model\", model];"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -16,7 +16,7 @@
 		{
 			"claim": "FRESHCALL-CLAUDE-ARGV-EQUALS-FORM",
 			"title": "claude-code goes back to the variadic space form, which swallows the prompt as an option value",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
 				"\t\t\treturn [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]}`, `--model=${model}`];"
 			],
@@ -31,7 +31,7 @@
 		{
 			"claim": "FRESHCALL-PI-MODEL-ARGV",
 			"title": "pi drops its measured two-token model option and silently resolves its ambient default again",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": ["\t\t\treturn [composition.prompt, \"--entwurf-control\", \"--model\", model];"],
 			"replace": ["\t\t\treturn [composition.prompt, \"--entwurf-control\"];"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -42,7 +42,7 @@
 		{
 			"claim": "FRESHCALL-PI-MODEL-DIALECT",
 			"title": "pi model argv is unified with Claude Code into the equals form that the real Pi parser rejects",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": ["\t\t\treturn [composition.prompt, \"--entwurf-control\", \"--model\", model];"],
 			"replace": ["\t\t\treturn [composition.prompt, \"--entwurf-control\", `--model=${model}`];"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -53,7 +53,7 @@
 		{
 			"claim": "FRESHCALL-CLAUDE-MODEL-ARGV",
 			"title": "Claude Code drops the explicit model token and silently resolves its ambient Opus default again",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
 				"\t\t\treturn [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]}`, `--model=${model}`];"
 			],
@@ -66,7 +66,7 @@
 		{
 			"claim": "FRESHCALL-CALLBACK-PRECEDES-TASK",
 			"title": "the task is framed before the callback instruction, so a sibling that stalls in the task never names itself",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": ["\t\t`FIRST ACTION, before reading files or anything else: call ${tool} with ` +"],
 			"replace": ["\t\t`FINAL ACTION, after completing the task: call ${tool} with ` +"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -123,7 +123,7 @@
 			"title": "one surface drops the optional cwd from its schema, so cross-repo fresh works from pi and silently cannot exist from the MCP bridge",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tcwd: z\n\t\t\t.string()\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). Omit or pass \\\"\\\" to start where the CALLER is: its own directory, or for a Codex caller its own record directory, because this bridge is the app-server's child and that process's directory is not the caller's. The receipt echoes the directory that was REQUESTED or the caller record it came from, never an observation of where the pane landed.\",\n\t\t\t),\n"
+				"\t\tcwd: z\n\t\t\t.string()\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \\\"\\\" to start where the CALLER is — this agent's own cwd on BOTH rails, or for a Codex caller its own record directory, because this bridge is the app-server's child and that process's directory is not the caller's. Taken exactly as given: no trim, no realpath, no project-name resolution. '#' is refused on the tmux rail only, because tmux format-expands a start directory; inside herdr it is an ordinary path character. The receipt echoes the directory that was REQUESTED or the caller record it came from, never an observation of where the pane landed.\",\n\t\t\t),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -239,7 +239,7 @@
 		{
 			"claim": "FRESHCALL-COPILOT-ARGV-INTERACTIVE",
 			"title": "the Copilot prompt rides -p instead of --interactive — the turn runs and the CLI EXITS, closing the window on a sibling that was supposed to stay open",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": ["\t\t\treturn [\"copilot\", \"--interactive\", composition.prompt, \"--model\", model, \"--yolo\"];"],
 			"replace": ["\t\t\treturn [\"copilot\", \"-p\", composition.prompt, \"--model\", model, \"--yolo\"];"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -250,7 +250,7 @@
 		{
 			"claim": "FRESHCALL-COPILOT-MODEL-ARGV",
 			"title": "the Copilot argv drops the explicit model — the managed launcher then injects `--model auto` and the caller's model choice is silently discarded",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": ["\t\t\treturn [\"copilot\", \"--interactive\", composition.prompt, \"--model\", model, \"--yolo\"];"],
 			"replace": ["\t\t\treturn [\"copilot\", \"--interactive\", composition.prompt, \"--yolo\"];"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -261,7 +261,7 @@
 		{
 			"claim": "FRESHCALL-COPILOT-YOLO-POLICY",
 			"title": "the policy token narrows back to the callback-only --allow-tool grant — the exact regression GLG measured on 2026-08-25: no YOLO in the footer, a confirmation prompt at every task tool, an impractical sibling",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": ["\t\t\treturn [\"copilot\", \"--interactive\", composition.prompt, \"--model\", model, \"--yolo\"];"],
 			"replace": [
 				"\t\t\treturn [\"copilot\", \"--interactive\", composition.prompt, \"--model\", model, \"--allow-tool=entwurf-bridge(entwurf_v2)\"];"
@@ -274,7 +274,7 @@
 		{
 			"claim": "FRESHCALL-COPILOT-CALLBACK-TOOL",
 			"title": "the Copilot callback names Claude Code's `mcp__server__tool` spelling — a dialect copied instead of measured, and the whole first turn is spent looking for a tool that is not there",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": ["\tcopilot: \"entwurf-bridge-entwurf_v2\","],
 			"replace": ["\tcopilot: \"mcp__entwurf-bridge__entwurf_v2\","],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -420,7 +420,7 @@
 		{
 			"claim": "FRESHCALL-COPILOT-EXPLICIT-POLICY",
 			"title": "the composition stops stating its policy and silently leans on the launcher to inject --yolo — the effective profile survives but the fresh contract loses its explicit permission statement",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": ["\t\t\treturn [\"copilot\", \"--interactive\", composition.prompt, \"--model\", model, \"--yolo\"];"],
 			"replace": ["\t\t\treturn [\"copilot\", \"--interactive\", composition.prompt, \"--model\", model];"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -512,7 +512,7 @@
 			"title": "one surface drops the optional seat from its schema, so opening a sibling in the operator's project session works from pi and silently cannot exist from the MCP bridge",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tplacement: z\n\t\t\t.object({\n\t\t\t\ttmuxSession: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.describe(\n\t\t\t\t\t\t\"EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid.\",\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server, and it always wins. When omitted the seat follows the CALLER, never the backend being opened: a Codex CALLER opens beside its own TUI pane, matched by thread-id in that pane's terminal title (0 or 2+ matching panes refuse, never fall back); every other caller opens in its own session. A pane title is a placement input only — never an address, liveness or delivery fact. Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name (absent for the caller-pane rule, which observed a session rather than requesting a name), its source, and resolved target session id.\",\n\t\t\t),\n"
+				"\t\tplacement: z\n\t\t\t.object({\n\t\t\t\ttmuxSession: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.describe(\n\t\t\t\t\t\t\"EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid.\",\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional expert seat override, TMUX ONLY: open the sibling in ONE EXISTING tmux session of this agent's own server, and it always wins. When omitted the seat follows the CALLER, never the backend being opened: a Codex CALLER opens beside its own TUI pane, matched by thread-id in that pane's terminal title (0 or 2+ matching panes refuse, never fall back); every other caller opens in its own session. A pane title is a placement input only — never an address, liveness or delivery fact. Nothing is ever created. Inside herdr this field is refused by name — placement there belongs to herdr, and a tmux session name would silently place the sibling somewhere else. Independent of cwd; neither is inferred from the other. The receipt reports the selected name (absent for the caller-pane rule, which observed a session rather than requesting a name), its source, and resolved target session id.\",\n\t\t\t),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -520,11 +520,61 @@
 			"signature": "[QK:FRESHCALL-PLACEMENT-SURFACE-PARITY]",
 			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
 		},
+		{
+			"claim": "FRESHCOMP-NODE-ONLY-IMPORTS",
+			"title": "the composition leaf takes a repo-local import again — one is all it takes for the tmux rail to be back behind a rail that has no tmux",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["import { randomBytes } from \"node:crypto\";"],
+			"replace": ["import { randomBytes } from \"node:crypto\";\nimport { runTmux } from \"./mux-placement.ts\";"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCOMP-NODE-ONLY-IMPORTS]",
+			"signatureSource": "test/fresh-call-composition.contract.test.ts"
+		},
+		{
+			"claim": "FRESHCOMP-TMUX-OPENING-LINE",
+			"title": "the extraction quietly reworded the tmux rail's first sentence — the sibling is told where it is by a refactor rather than by a measurement",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\"You are a fresh visible citizen that entwurf opened in the operator's tmux session.\";"],
+			"replace": ["\t\"You are a fresh visible citizen that entwurf opened in a terminal pane.\";"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCOMP-TMUX-OPENING-LINE]",
+			"signatureSource": "test/fresh-call-composition.contract.test.ts"
+		},
+		{
+			"claim": "FRESHCOMP-RAIL-OWNS-PLACEMENT-SENTENCE",
+			"title": "the leaf invents a placement sentence when the rail supplies none — a default that is true on one rail is a lie on the other",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": [
+				"\tif (params.openingLine.length === 0) {\n\t\tthrow new Error(\"fresh-call composition: openingLine is empty — the rail must state where it placed the sibling\");\n\t}"
+			],
+			"replace": [
+				"\tconst openingLine =\n\t\tparams.openingLine.length === 0\n\t\t\t? \"You are a fresh visible citizen that entwurf opened in the operator's tmux session.\"\n\t\t\t: params.openingLine;\n\tvoid openingLine;"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCOMP-RAIL-OWNS-PLACEMENT-SENTENCE]",
+			"signatureSource": "test/fresh-call-composition.contract.test.ts"
+		},
+		{
+			"claim": "FRESHCOMP-CODEX-SOCKET-LAZY",
+			"title": "the injected Codex socket is resolved for every backend — a host with no Codex home stops opening pi and claude siblings, which the inline call never did",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["): string[] {\n\tswitch (backend) {\n\t\tcase \"pi\":"],
+			"replace": [
+				"): string[] {\n\tconst eager = resolveCodexSocketPath();\n\tvoid eager;\n\tswitch (backend) {\n\t\tcase \"pi\":"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCOMP-CODEX-SOCKET-LAZY]",
+			"signatureSource": "test/fresh-call-composition.contract.test.ts"
+		},
 		{
 			"claim": "FRESHCALL-CODEX-THREAD-CWD",
 			"title": "codex loses the `-C <dir>` token, so an attached thread opens in the APP-SERVER's directory while its pane sits somewhere else — the launch, the receipt and the pane all still look right",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
-			"find": ["\t\t\t\t\"-C\",\n\t\t\t\tlaunchCwd,\n"],
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["\t\t\t\t\"-C\",\n\t\t\t\tresolveCodexLaunchCwd(),\n"],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 120,
@@ -534,8 +584,8 @@
 		{
 			"claim": "FRESHCALL-CWD-CALLER-ONLY",
 			"title": "the codex dialect reads THIS process's directory instead of the directory the launch chose, so a cross-repo or caller-record cwd places the pane while the thread opens somewhere else",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
-			"find": ["\t\t\t\tlaunchCwd,\n"],
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["\t\t\t\tresolveCodexLaunchCwd(),\n"],
 			"replace": ["\t\t\t\tprocess.cwd(),\n"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 120,
@@ -602,6 +652,43 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:FRESHCALL-CALLER-CWD-SURFACE]",
 			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
+		},
+		{
+			"claim": "FRESHCOMP-PEERS-TOOL-DIALECT",
+			"title": "the corroboration the framing offers goes back to one bare spelling, so four of the five backends are offered a tool name their own session does not expose",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["\tconst peersTool = FRESH_CALL_PEERS_TOOL[params.backend];"],
+			"replace": ["\tconst peersTool = \"entwurf_peers\";"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCOMP-PEERS-TOOL-DIALECT]",
+			"signatureSource": "test/fresh-call-composition.contract.test.ts"
+		},
+		{
+			"claim": "FRESHCOMP-RESULT-GOES-TO-CALLER",
+			"title": "the first turn stops naming where the result goes, so a sibling finishes its task, prints the answer in its own window, and the caller never learns it is done",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": [
+				"\t\t`When the task reaches its requested final result, send that result to the same target with ${tool}.`,"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCOMP-RESULT-GOES-TO-CALLER]",
+			"signatureSource": "test/fresh-call-composition.contract.test.ts"
+		},
+		{
+			"claim": "FRESHCOMP-TOOL-LOAD-HINT-CLAUDE-ONLY",
+			"title": "the Claude child loses the one sentence that tells it how to load a deferred callback tool — the framing goes back to naming a tool the child cannot call on its first turn, which is the measured silence: 0/5 directly callable, 5 of 14 production launches dead",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": [
+				"\t\"claude-code\": [\n\t\t\"If ${callbackTool} is not callable yet, the entwurf-bridge server is still connecting or its\",\n\t\t'tools are deferred: load them first with ToolSearch(\"select:${callbackTool},${peersTool}\") —',\n\t\t\"it waits for the server — then call ${callbackTool}.\",\n\t],"
+			],
+			"replace": ["\t\"claude-code\": [],"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:FRESHCOMP-TOOL-LOAD-HINT-CLAUDE-ONLY]",
+			"signatureSource": "test/fresh-call-composition.contract.test.ts"
 		}
 	]
 }

package/scripts/mutants/mux-launcher-fence.json

@@ -118,6 +118,19 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:LAUNCHFENCE-WIRED-FRESH-CALL]",
 			"signatureSource": "scripts/check-mux-launcher-fence.ts"
+		},
+		{
+			"claim": "LAUNCHFENCE-EXPOSED-SMOKE-WIRED",
+			"title": "the teardown verifies a launcher snapshot taken AFTER the children ran instead of the one pinned before them — every name the fence exports is still in the file, so a presence check passes, while the oracle now compares the damage to itself and a retarget reads as 'unchanged'",
+			"subject": "scripts/smoke-herdr-fresh-call-live.ts",
+			"find": ["\t\tconst launcherProblems = verifyClaudeLauncher(launcher);"],
+			"replace": [
+				"\t\tconst launcherProblems = verifyClaudeLauncher(snapshotClaudeLauncher({ env: process.env, fixtureRoot: root }));"
+			],
+			"gate": ["bash", "run.sh", "check-mux-launcher-fence"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:LAUNCHFENCE-EXPOSED-SMOKE-WIRED]",
+			"signatureSource": "scripts/check-mux-launcher-fence.ts"
 		}
 	]
 }

package/scripts/mutants/omp-fresh.json

@@ -5,7 +5,7 @@
 		{
 			"claim": "ADMISSION-FRESH-PARITY",
 			"title": "a post-#82 harness admitted as a full D6 citizen while entwurf_fresh_call cannot open it — the exact state the Bundle A+B candidate shipped in, where every gate was green and only prose said the backend was unsupported. This is the defect the whole gate exists for: without it, an `unsupported` note reads as a partial-release permit",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
 				"export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\"] as const;"
 			],
@@ -31,7 +31,7 @@
 		{
 			"claim": "FRESHCALL-OMP-EXPLICIT-POLICY",
 			"title": "the permission width dropped from the omp argv. NOTHING OBSERVABLE FAILS: omp 18.0.0's schema default for tools.approvalMode is ALREADY yolo, so the sibling still boots and a LIVE acceptance still passes — the argv has simply started depending on a vendor default and on whatever the operator's config happens to say. This is the drift step 9 clause 2 forbids, and it is invisible to every test that only watches behaviour",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
 				"\t\t\treturn [`--${OMP_BOOTSTRAP_FLAG}`, composition.bootstrapPayload, \"--model\", model, \"--approval-mode\", \"yolo\"];"
 			],
@@ -44,7 +44,7 @@
 		{
 			"claim": "FRESHCALL-OMP-CALLBACK-TOOL-DIALECT",
 			"title": "the callback tool name spelled the way a reader expects instead of the way omp mints it — `entwurf_v2` keeps its digit, which omp's sanitizer charset [a-z_] eats. The sibling is told to call a tool that does not exist in its session, so the whole first turn is spent and no address ever comes back. A launch receipt still prints",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": ["\tomp: \"mcp__entwurf_bridge_entwurf_v\","],
 			"replace": ["\tomp: \"mcp__entwurf_bridge_entwurf_v2\","],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -129,7 +129,7 @@
 		{
 			"claim": "FRESHCALL-OMP-ARGV-BOOTSTRAP-FLAG",
 			"title": "the positional first-turn prompt put back on the omp argv beside the bootstrap flag — the exact shape the first Bundle C candidate shipped. `[LIVE 2026-08-30]` it opens a window whose turn starts ~830ms BEFORE the callback tool exists, and the sibling answers the literal text `ACK` with zero tool calls. It parses, it launches, and the caller times out at 240s: the failure is invisible to anything that only checks that argv is well-formed",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
 				"\t\t\treturn [`--${OMP_BOOTSTRAP_FLAG}`, composition.bootstrapPayload, \"--model\", model, \"--approval-mode\", \"yolo\"];"
 			],

package/scripts/mutants/peer-facts.json

@@ -0,0 +1,98 @@
+{
+	"schemaVersion": 1,
+	"lane": "peer-facts",
+	"mutants": [
+		{
+			"claim": "PF-PLACEMENT-STRUCTURED",
+			"title": "stringifying placement into the human `herdr <pane>` form hands a machine consumer a presentation decision to re-parse — the pane id stops being a field and becomes a substring, which is exactly the re-implementation this verb exists to remove (#116 M2-a)",
+			"subject": "scripts/peer-facts.ts",
+			"find": ["const { payload } = renderEntwurfPeers(result);"],
+			"replace": [
+				"const { payload } = renderEntwurfPeers(result);\npayload.peers = payload.peers.map((p) => ({\n\t...p,\n\tplacement: (p.placement.kind === \"herdr-pane\" ? `herdr ${p.placement.paneId}` : p.placement.kind) as never,\n}));"
+			],
+			"gate": ["bash", "run.sh", "check-peer-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PF-PLACEMENT-STRUCTURED]",
+			"signatureSource": "scripts/check-peer-facts.ts"
+		},
+		{
+			"claim": "PF-PEER-KEYSET-EXACT",
+			"title": "letting a herdr display verdict (agent_status) into a peer row opens the one door through which herdr's screen judgement becomes an entwurf fact, and from there a rename away from delivery liveness (#116 M2-a, docs/herdr-launch-rail.md §9)",
+			"subject": "scripts/peer-facts.ts",
+			"find": ["const projection = { schemaVersion: 1, storeDir, ...payload };"],
+			"replace": [
+				"const projection = {\n\tschemaVersion: 1,\n\tstoreDir,\n\t...payload,\n\tpeers: payload.peers.map((p) => ({ ...p, agentStatus: \"idle\" })),\n};"
+			],
+			"gate": ["bash", "run.sh", "check-peer-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PF-PEER-KEYSET-EXACT]",
+			"signatureSource": "scripts/check-peer-facts.ts"
+		},
+		{
+			"claim": "PF-NO-SOCKET-COORDINATE",
+			"title": "republishing the control-socket dir undoes the #50 C4 retirement that removed the legacy listing together with the controlDir it exposed — the record is the sole address axis and a socket path is dispatch-internal transport, so a convenience field here reopens a second address-shaped axis (#116 M2-a)",
+			"subject": "scripts/peer-facts.ts",
+			"find": ["const projection = { schemaVersion: 1, storeDir, ...payload };"],
+			"replace": ["const projection = { schemaVersion: 1, storeDir, controlDir, ...payload };"],
+			"gate": ["bash", "run.sh", "check-peer-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PF-NO-SOCKET-COORDINATE]",
+			"signatureSource": "scripts/check-peer-facts.ts"
+		},
+		{
+			"claim": "PF-DIAGNOSTICS-PRESERVED",
+			"title": "dropping the provider's diagnostics turns a store carrying hazards into a clean-looking listing at exit 0 — the consumer is told about the healthy citizens and never about what was refused (#116 M2-a)",
+			"subject": "scripts/peer-facts.ts",
+			"find": ["process.stdout.write(`${JSON.stringify(projection, null, 2)}\\n`);"],
+			"replace": ["process.stdout.write(`${JSON.stringify({ ...projection, diagnostics: [] }, null, 2)}\\n`);"],
+			"gate": ["bash", "run.sh", "check-peer-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PF-DIAGNOSTICS-PRESERVED]",
+			"signatureSource": "scripts/check-peer-facts.ts"
+		},
+		{
+			"claim": "PF-CONTROL-DIR-PROBED",
+			"title": "ignoring ENTWURF_DIR probes a different socket world than the bridge does, so this verb and entwurf_peers can answer the same question from two worlds while both look green (#116 M2-a)",
+			"subject": "scripts/peer-facts.ts",
+			"find": ["\tsocket: { dir: controlDir },"],
+			"replace": ["\tsocket: { dir: defaultControlSocketDir(os.homedir()) },"],
+			"gate": ["bash", "run.sh", "check-peer-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PF-CONTROL-DIR-PROBED]",
+			"signatureSource": "scripts/check-peer-facts.ts"
+		},
+		{
+			"claim": "PF-NO-OBSERVATION-BUDGET",
+			"title": "rationing observations emits `unobserved` for rows nobody chose to skip, and in a machine payload that is indistinguishable from `nobody could look` — a fabricated measurement about a read that did not happen (#116 M2-a)",
+			"subject": "scripts/peer-facts.ts",
+			"find": ["\tsocket: { dir: controlDir },\n\t// No `observationLimit`"],
+			"replace": ["\tsocket: { dir: controlDir },\n\tobservationLimit: 0,\n\t// No `observationLimit`"],
+			"gate": ["bash", "run.sh", "check-peer-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PF-NO-OBSERVATION-BUDGET]",
+			"signatureSource": "scripts/check-peer-facts.ts"
+		},
+		{
+			"claim": "PF-EXIT-UNREADABLE",
+			"title": "answering an unreadable store with exit 0 makes an unreadable host look like an empty one — the same false-success class the #65 exit contract exists to refuse, one axis out (#116 M2-a)",
+			"subject": "scripts/peer-facts.ts",
+			"find": ["\tprocess.exit(3); // see the EXIT CONTRACT above: 3 = unreadable store, never an empty one"],
+			"replace": ["\tprocess.exit(0); // see the EXIT CONTRACT above: 3 = unreadable store, never an empty one"],
+			"gate": ["bash", "run.sh", "check-peer-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PF-EXIT-UNREADABLE]",
+			"signatureSource": "scripts/check-peer-facts.ts"
+		},
+		{
+			"claim": "PF-USAGE",
+			"title": "reading a dash argv as a store directory answers `--help` with `empty store, exit 0` — a silent wrong fact where a refusal belongs (#116 M2-a)",
+			"subject": "scripts/peer-facts.ts",
+			"find": ["if (process.argv.length > 3 || (arg !== undefined && arg.startsWith(\"-\"))) {"],
+			"replace": ["if (process.argv.length > 3) {"],
+			"gate": ["bash", "run.sh", "check-peer-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PF-USAGE]",
+			"signatureSource": "scripts/check-peer-facts.ts"
+		}
+	]
+}

package/scripts/mutants/pi-launch.json

@@ -0,0 +1,113 @@
+{
+	"schemaVersion": 1,
+	"lane": "pi-launch",
+	"mutants": [
+		{
+			"claim": "PILAUNCH-FLAG-SSOT",
+			"title": "the launcher spells the control flag itself, so a typo in run.sh silently produces a pi that is not a citizen and reports nothing",
+			"subject": "run.sh",
+			"find": ["    exec \"$entwurf_pi_bin\" --entwurf-control \"$@\""],
+			"replace": ["    exec \"$entwurf_pi_bin\" --entwurf-controll \"$@\""],
+			"gate": ["bash", "run.sh", "check-pi-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PILAUNCH-FLAG-SSOT]",
+			"signatureSource": "scripts/check-pi-launch.ts"
+		},
+		{
+			"claim": "PILAUNCH-VERB-DROPPED",
+			"title": "without the shift the dispatcher verb stays in the forwarded argv and `pi` arrives at the vendor as a prompt argument",
+			"subject": "run.sh",
+			"find": ["    shift || true\n    if [ -n \"${ENTWURF_PI_LAUNCH_ACTIVE:-}\" ]; then"],
+			"replace": ["    if [ -n \"${ENTWURF_PI_LAUNCH_ACTIVE:-}\" ]; then"],
+			"gate": ["bash", "run.sh", "check-pi-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PILAUNCH-VERB-DROPPED]",
+			"signatureSource": "scripts/check-pi-launch.ts"
+		},
+		{
+			"claim": "PILAUNCH-FLAG-FIRST",
+			"title": "injecting the flag AFTER the operator argv puts it behind a positional prompt, where pi reads it as data instead of standing up a control socket",
+			"subject": "run.sh",
+			"find": ["    exec \"$entwurf_pi_bin\" --entwurf-control \"$@\""],
+			"replace": ["    exec \"$entwurf_pi_bin\" \"$@\" --entwurf-control"],
+			"gate": ["bash", "run.sh", "check-pi-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PILAUNCH-FLAG-FIRST]",
+			"signatureSource": "scripts/check-pi-launch.ts"
+		},
+		{
+			"claim": "PILAUNCH-NOTHING-ELSE-INJECTED",
+			"title": "a launcher that also injects operator taste stops being a spelling and starts deciding the session (Rule 9)",
+			"subject": "run.sh",
+			"find": ["    exec \"$entwurf_pi_bin\" --entwurf-control \"$@\""],
+			"replace": ["    exec \"$entwurf_pi_bin\" --entwurf-control --emacs-agent-socket \"$@\""],
+			"gate": ["bash", "run.sh", "check-pi-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PILAUNCH-NOTHING-ELSE-INJECTED]",
+			"signatureSource": "scripts/check-pi-launch.ts"
+		},
+		{
+			"claim": "PILAUNCH-ARGV-BYTES",
+			"title": "an unquoted forward word-splits the operator argv and drops empty elements, so a quoted prompt silently becomes several arguments",
+			"subject": "run.sh",
+			"find": ["    exec \"$entwurf_pi_bin\" --entwurf-control \"$@\""],
+			"replace": ["    exec \"$entwurf_pi_bin\" --entwurf-control $@"],
+			"gate": ["bash", "run.sh", "check-pi-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PILAUNCH-ARGV-BYTES]",
+			"signatureSource": "scripts/check-pi-launch.ts"
+		},
+		{
+			"claim": "PILAUNCH-EXEC-KEEPS-PID",
+			"title": "forking instead of exec leaves run.sh as a parent that supervises nothing and owns neither the terminal nor the exit",
+			"subject": "run.sh",
+			"find": ["    exec \"$entwurf_pi_bin\" --entwurf-control \"$@\""],
+			"replace": ["    \"$entwurf_pi_bin\" --entwurf-control \"$@\""],
+			"gate": ["bash", "run.sh", "check-pi-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PILAUNCH-EXEC-KEEPS-PID]",
+			"signatureSource": "scripts/check-pi-launch.ts"
+		},
+		{
+			"claim": "PILAUNCH-VENDOR-ABSENT",
+			"title": "an absent vendor that exits 0 is the false success this repo refuses: nothing launched and the caller was told it worked",
+			"subject": "run.sh",
+			"find": [
+				"      echo \"         'entwurf pi' launches the pi coding agent; it does not install one.\" >&2\n      exit 1"
+			],
+			"replace": [
+				"      echo \"         'entwurf pi' launches the pi coding agent; it does not install one.\" >&2\n      exit 0"
+			],
+			"gate": ["bash", "run.sh", "check-pi-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PILAUNCH-VENDOR-ABSENT]",
+			"signatureSource": "scripts/check-pi-launch.ts"
+		},
+		{
+			"claim": "PILAUNCH-SENTINEL-EXPORTED",
+			"title": "a sentinel that is set but not exported is invisible to the re-entered child, so the recursion fence never fires and the terminal hangs",
+			"subject": "run.sh",
+			"find": ["    export ENTWURF_PI_LAUNCH_ACTIVE=1"],
+			"replace": ["    ENTWURF_PI_LAUNCH_ACTIVE=1"],
+			"gate": ["bash", "run.sh", "check-pi-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PILAUNCH-SENTINEL-EXPORTED]",
+			"signatureSource": "scripts/check-pi-launch.ts"
+		},
+		{
+			"claim": "PILAUNCH-RECURSION-FENCE",
+			"title": "with the fence removed a PATH `pi` that shells back here spins forever, and the symptom is a hung terminal rather than an error",
+			"subject": "run.sh",
+			"find": [
+				"    if [ -n \"${ENTWURF_PI_LAUNCH_ACTIVE:-}\" ]; then\n      echo \"entwurf: recursive managed launch detected (ENTWURF_PI_LAUNCH_ACTIVE is already set).\" >&2"
+			],
+			"replace": [
+				"    if false; then\n      echo \"entwurf: recursive managed launch detected (ENTWURF_PI_LAUNCH_ACTIVE is already set).\" >&2"
+			],
+			"gate": ["bash", "run.sh", "check-pi-launch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PILAUNCH-RECURSION-FENCE]",
+			"signatureSource": "scripts/check-pi-launch.ts"
+		}
+	]
+}

package/scripts/mutants/resume-args.json

@@ -11,7 +11,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-resume-args"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:RESUMEARGS-NO-HEADLESS]",
-			"signatureSource": "scripts/check-entwurf-resume-args.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-resume-args.test.ts"
 		},
 		{
 			"claim": "RESUMEARGS-CONTROL-FIRST",
@@ -24,7 +24,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-resume-args"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:RESUMEARGS-CONTROL-FIRST]",
-			"signatureSource": "scripts/check-entwurf-resume-args.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-resume-args.test.ts"
 		},
 		{
 			"claim": "RESUMEARGS-EXT-ONCE-BEFORE-SESSION",
@@ -37,7 +37,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-resume-args"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:RESUMEARGS-EXT-ONCE-BEFORE-SESSION]",
-			"signatureSource": "scripts/check-entwurf-resume-args.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-resume-args.test.ts"
 		},
 		{
 			"claim": "RESUMEARGS-SESSION-IS-FILE",
@@ -48,7 +48,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-resume-args"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:RESUMEARGS-SESSION-IS-FILE]",
-			"signatureSource": "scripts/check-entwurf-resume-args.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-resume-args.test.ts"
 		},
 		{
 			"claim": "RESUMEARGS-PROVIDER-OPTIONAL",
@@ -59,7 +59,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-resume-args"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:RESUMEARGS-PROVIDER-OPTIONAL]",
-			"signatureSource": "scripts/check-entwurf-resume-args.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-resume-args.test.ts"
 		},
 		{
 			"claim": "RESUMEARGS-NO-PROMPT-TAIL",
@@ -70,7 +70,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-resume-args"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:RESUMEARGS-NO-PROMPT-TAIL]",
-			"signatureSource": "scripts/check-entwurf-resume-args.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-resume-args.test.ts"
 		}
 	]
 }

package/scripts/mutants/self-address.json

@@ -88,6 +88,39 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:SELFADDR-MAILBOX-WAKE-SEAM]",
 			"signatureSource": "scripts/check-entwurf-self-address.ts"
+		},
+		{
+			"claim": "SELFADDR-UNCITIZENED-NOTICED",
+			"title": "passing a constant instead of the real flag makes the decision unreachable and the notice a property of nothing — this is the defect an independent review walked through the first cut's source regex with (measured 2026-09-17: moving the call into the citizen branch left the gate 51/51 green), because a regex sees that a call exists and cannot see which fact it carries",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": ["\t\tawait noticeUncitizenedSession(ctx, enabled);"],
+			"replace": ["\t\tawait noticeUncitizenedSession(ctx, false);"],
+			"gate": ["bash", "run.sh", "check-entwurf-self-address"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SELFADDR-UNCITIZENED-NOTICED]",
+			"signatureSource": "scripts/check-entwurf-self-address.ts"
+		},
+		{
+			"claim": "SELFADDR-UNCITIZENED-ONCE",
+			"title": "dropping the line that records the notice fired turns a one-time hint into a nag: `refreshServer` runs again on every session switch, so the operator who already read the sentence reads it again each time — and the second cut's own comment is what claims this cannot happen",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": ["\tuncitizenedNoticeShown = true;"],
+			"replace": ["\tvoid uncitizenedNoticeShown;"],
+			"gate": ["bash", "run.sh", "check-entwurf-self-address"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SELFADDR-UNCITIZENED-ONCE]",
+			"signatureSource": "scripts/check-entwurf-self-address.ts"
+		},
+		{
+			"claim": "SELFADDR-UNCITIZENED-DECISION",
+			"title": "letting the decision answer yes for a session that DOES have --entwurf-control tells a citizen it is not one — the exact inversion the mirror contract exists to prevent, and the reason the three conditions are a truth table here instead of ifs at a call site a regex was pretending to cover",
+			"subject": "pi-extensions/lib/entwurf-self-address.ts",
+			"find": ["\tif (facts.controlEnabled) return false;"],
+			"replace": ["\tif (false && facts.controlEnabled) return false;"],
+			"gate": ["bash", "run.sh", "check-entwurf-self-address"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SELFADDR-UNCITIZENED-DECISION]",
+			"signatureSource": "scripts/check-entwurf-self-address.ts"
 		}
 	]
 }

package/scripts/mutants/typing-call-fence.json

@@ -0,0 +1,17 @@
+{
+	"schemaVersion": 1,
+	"lane": "typing-call-fence",
+	"mutants": [
+		{
+			"claim": "TYPEFENCE-PRODUCTION-CLEAN",
+			"title": "a production module acquires a typing call — the launch rail starts reaching a sibling through the place a human types, which is the one channel this product measured and refused at design time and the one kind of 'delivery' that is only a screen write (Hard Rule 16)",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\"tab\",\n\t\t\"create\","],
+			"replace": ["\t\t\"tab\",\n\t\t\"create\",\n\t\t\"send-keys\","],
+			"gate": ["bash", "run.sh", "check-typing-call-fence"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:TYPEFENCE-PRODUCTION-CLEAN]",
+			"signatureSource": "scripts/check-typing-call-fence.ts"
+		}
+	]
+}